CVE-2014-2872

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain potentially sensitive information from a directory listing via unspecified vectors...

CVE-2014-2874: Improper Neutralization of Special Elements used in an OS Command

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context...

CVE-2014-2871: Exposure of Sensitive Information to an Unauthorized Actor

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on an HTTP session for entering credentials on login pages, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-2869: Exposure of Sensitive Information to an Unauthorized Actor

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information...

PT-2014-4936

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to obtain sensitive information via requests to unspecified URIs. This can include details such as...

PT-2014-4929

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue is related to a lack of authorization checks in certain situations, allowing remote authenticated users to perform actions. The...

CVE-2014-2873: Exposure of Sensitive Information to an Unauthorized Actor

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not require authentication for access to log files, which allows remote attackers to obtain sensitive server information by using a predictable name in a request for a file...

CVE-2014-2859: Undefined Security Weakness

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request...

PT-2014-4933

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue relies on client JavaScript code for access restrictions. This allows remote attackers to perform unspecified operations by...

PT-2014-4941

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context. Recommendations For...

PT-2014-4939

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to obtain potentially sensitive information from a directory listing. Recommendations For versions prio...

PT-2014-4935

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to modify the flow of execution of ColdFusion code. This can be achieved by using an HTTP GET request t...

PT-2014-4927

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP request to a ColdFusion or JavaScript...

PT-2014-4937

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The default configuration of PaperThin CommonSpot uses cleartext for storage of credentials in a database. This makes it easier for...

CVE-2014-2864: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences...

PT-2014-4928

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks via a crafted string. This is possible by bypassing a...

CVE-2014-2868: Undefined Security Weakness

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable...

CVE-2014-2863: Improper Limitation of a Pathname to a Restricted Directory

Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter...

CVE-2014-2862: Undefined Security Weakness

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote authenticated users to perform actions via unknown vectors...

PT-2014-4926

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to bypass intended access restrictions via a direct request. Recommendations For versions prior to 7.0....